Class: Authorio::Session

Inherits:
ApplicationRecord show all
Defined in:
app/models/authorio/session.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

  1. To guard against timing attacks, we lookup tokens based on a separate selector attribute and compare them using a secure time-constant comparison method

Raises:



21
22
23
24
25
26
27
 
# File 'app/models/authorio/session.rb', line 21

def self.find_by_cookie(cookie)
  selector, _token = cookie.split(':')
  session = find_by selector: selector
  raise Authorio::Exceptions::SessionReplayAttack.new, session unless session.matches_cookie?(cookie)

  session
end

Instance Method Details



39
40
41
 
# File 'app/models/authorio/session.rb', line 39

def as_cookie
  "#{selector}:#{token}"
end

#expired? ⇒ Boolean

Returns:

  • (Boolean) 


35
36
37
 
# File 'app/models/authorio/session.rb', line 35

def expired?
  expires_at < Time.now
end

#matches_cookie?(cookie) ⇒ Boolean

Returns:

  • (Boolean) 


29
30
31
32
33
 
# File 'app/models/authorio/session.rb', line 29

def matches_cookie?(cookie)
  _selector, token = cookie.split(':')
  cookie_hashed_token = Digest::SHA256.hexdigest token
  !expired? && ActiveSupport::SecurityUtils.secure_compare(cookie_hashed_token, hashed_token)
end